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REMARKS 

The specification has been amended to correct obvious 
typographical errors. 

To expedite prosecution, Claim 1 has been amended to 
incorporate the features of Claim 5 and the allowable subject 
matter of Claim 2. Accordingly, Claims 2, 5 have been canceled 
without prejudice. 

Claims 3, 4, 6-9, 12 have been amended to depend from 
Claim 1 and/or for consistency with the amendment of Claim 1. 

Claim 21 has been amended to incorporate features of Claim 
25, which accordingly has been canceled without prejudice. 
Claim 24 has been amended for consistency with the amendment of 
Claim 21. 

Claim 26 has been amended similarly to Claim 21. Further 
support for the amendment of Claim 26 appears in the 
specification at least at page 29, lines 30-36. 

The headings below are numbered to correspond with the 
heading numbering used by the Examiner in the Office Action. 

Request for Examiner Interview. 

Should the Examiner be of the opinion that this Amendment 
does not place the application in a condition for allowance, 
Applicants respectfully request an Examiner Interview prior to 
the issuance of the next communication from the USPTO to 
expedite prosecution. 

5. Claims 1, 11, 15, 19-22, 24, 26 satisfy 35 U.S.C. § 101, 
The Examiner states: 

The ''determining whether said call ... per se does not 
produce a tangible result. (Office Action, page 2.) 
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To expedite prosecution. Claim 1 has been amended to 
incorporate features of Claim 5 and now recites: 
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A method comprising: 

stalling a call to a critical operating system 

(OS) function; 

determining whether branch trace records of said 

call include a return instruction comprising: 

locating a most recent branch trace record of 
said branch trace records; 

searching said branch trace records from said 
most recent branch trace record to locate a user 
to kernel branch trace record of said branch trace 
records ; and 

searching previous branch trace records 
previous to said user to kernel branch trace 
record for said return instruction; and 
taking protective action to protect a computer 

system upon a determination that said branch trace 

records include said return instruction. (Emphasis 

added . ) 



Accordingly, Claim 1 satisfies 35 U.S. C. § 101. Claims 
11, 15, 19-20, which depend from Claim 1, satisfy 35 U.S.C. § 
101 for at least the same reasons as Claim 1. 

Claims 21, 26 satisfy 35 U.S.C. § 101 for reasons similar 
to Claim 1. Claims 22, 24, which depend from Claim 21, satisfy 
35 U.S.C. § 101 for at least the same reasons as Claim 21. 

For the above reasons. Applicants respectfully request 
reconsideration and withdrawal of this rejection. 



6. Claim 26 satisfies 35 U.S.C, § 101. 
The Examiner states : 



The phrase ''A computer program product comprising" is 
not necessarily embodied software on computer readable 
media (subject to inclusion of said subject matter in 
the specification) corresponding to a method of said 
embodied software. (Office Action, page 2.) 



To expedite prosecution. Claim 26 has been amended and now 
recites : 
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A computer program product comprising a tangible 
computer readad^le medium containing computer program 
code comprising: 
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a Return-to-LIBC attack detection application for 

recording branch trace records; 

said Return-to-LIBC attack detection application 

further for stalling a call to a critical operating 

system (OS) functions- 
said Return-to-LIBC attack detection application 

further for suspending recording of said branch trace 

records ; 

said Return-to-LIBC attack detection application 
further for locating a most recent branch trace record 
of said branch trace records; 

said Return-to-LIBC attack detection application 
further for searching said branch trace records from 
said most recent branch trace record to locate a user 
to kernel branch trace record of said branch trace 
records ; and 

said Return-to-LIBC attack detection application 
further for determining whether previous branch trace 
records previous to said user to kernel branch trace 
record include only call, jump, or interrupt 
instructions, wherein upon a determination that at 
least one of said previous branch trace records 
includes a return instruction, said Return-to-LIBC 
attack detection application further for taking 
protective action to protect a computer system. 
(Emphasis added.) 



Accordingly, Claim 26 satisfies 35 U.S.C. § 101. 
For the above reasons, Applicants respectfully request 
reconsideration and withdrawal of this rejection. 



7-24) Claims 1, 6-20 are novel over Baratloo. 

Claim 1 has been amended to incorporate the allowable 
subject matter of Claim 2. Accordingly, Claim 1 is allowable 
over Baratloo, Claims 6-20, which depend from Claim 1, are 
allowable for at least the same reasons as Claim 1. 

For the above reasons. Applicants respectfully request 
reconsideration and withdrawal of this rejection. 



25-35) Allowable subject matter. 
Claims 21-24, 26 are allowed. 

Claim 1 has been amended to incorporate the allowable 
HODGSON. L.L.P. subject matter of Claim 2. Accordingly, Claim 1 is allowable. 
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Claims 3-4, which depend from Claim 1, are allowable for at 
least the same reasons as Claim 1. 

For the above reasons. Applicants respectfully request 
reconsideration and withdrawal of the objection to Claims 3-4. 

Conclusion 

Claims 1, 3-4, 6-24, 26 are pending in the application. 
For the foregoing reasons. Applicants respectfully request 
allowance of all pending claims. If the Examiner has any 
questions relating to the above, the Examiner is respectfully 
requested to telephone the undersigned Attorney for Applicants, 



CERTIFICATE OF MAILING 
I hereby certify that this correspondence is being deposited with the 
United States Postal Service with sufficient postage as first class mail 
in an enySope addressed to: Commissioner for Patents, P.O. Box 
1450, A eJcandria, VA 223 13-1450, on May 17, 2007. 



May 17. 2007 
Date of Signature 



Respeattfully submitted. 






Ser^^ J./ Hodgson 
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